Meta Says Instagram Recovery Flaw Compromised 20,225 Accounts
Summary
Meta reported that a flaw in Instagram’s High Touch Support recovery system let unauthorized parties reset passwords and compromise 20,225 accounts. Meta disabled the tool, invalidated reset links, and plans stronger validation.
Key points
- Meta said the flaw failed to verify that a password-reset email matched the email address on the Instagram account.
- According to Meta’s incident notification to the Maine Attorney General, unauthorized parties exploited the flaw to reset passwords on 20,225 accounts.
- Meta said it discovered the vulnerability on May 31, 2026.
- Meta disabled the High Touch Support recovery tool and invalidated outstanding reset links.
- Meta plans to add stronger validation before redeploying the tool.
Article Details
- Victim Organization
- Incident Type
- Account recovery flaw exploited to trigger unauthorized password resets and hijack user profiles
- Data Types Exposed
- Private direct messages (potentially accessible)
- Photos (potentially accessible)
- Interaction history (potentially accessible)
- Affected Records
- 20,225 Instagram user accounts were reported compromised.
- Operational Impact
- Unauthorized third parties performed password resets and hijacked user profiles. Meta disabled High Touch Support, invalidated outstanding reset links, and planned stronger validation before redeployment.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Vendors
Products
High Touch Support (HTS)Meta disclosed that a flaw in Instagram’s High Touch Support account recovery system let unauthorized third parties trigger password resets and hijack user profiles.InstagramMeta disclosed that a flaw in Instagram’s High Touch Support account recovery system let unauthorized third parties trigger password resets and hijack user profiles.